fix(tools): trim raw GitHub payloads from write-tool responses

[saidsef]

What

Seven write tools shipped the raw GitHub API response straight to the LLM client - 1.5-3KB per call of user objects, reactions, _links and dozens of *_url fields. The CommentData/IssueData return annotations promised a compact shape, but FastMCP does no schema-based key stripping (verified in fastmcp-slim 3.4.2 convert_result, which serialises the raw return value), so the wire response never matched the advertised output schema.

This trims the seven offenders to the compact contracts the codebase already uses in get_pr_content, create_pr and list_open_issues_prs:

• add_pr_comments, add_inline_pr_comment -> {id, body, author, html_url, created_at}
• create_issue, update_issue -> {number, title, body, state, author, labels: string[], html_url, created_at, updated_at}
• update_reviews -> {id, state, body, html_url, submitted_at}
• create_release -> {id, tag_name, name, html_url, draft, prerelease, body} (body kept - it carries generated release notes)
• update_assignees -> one unified {status, assignees_requested, assignees_applied, issue_url} shape; previously the partial branch embedded the entire raw issue

Three small module-level helpers (_pick, _comment_result, _issue_result) do the trimming.

Why

• Every call to these tools cost the client roughly 300-700 wasted tokens.
• Measured end-to-end through the MCP layer: create_issue wire response drops from 1,085 bytes (mocked payload - real ones are 2-3x larger) to 219 bytes.
• Output schemas are now truthful: what tools/list advertises is what the tool returns.

Not changed

merge_pr, update_pr_branch and create_tag - GitHub already returns small payloads for these, and merge_pr has passthrough tests. get_pr_diff is untouched; the diff is the product.

Testing

• 64 tests pass (8 new: exact-equality assertions for all seven tools against realistic bloated payloads, including the two-request inline-comment flow and both update_assignees branches)
• ruff check . clean (also fixes two pre-existing violations in the test file), pyright 0 errors
• Booted the server locally in HTTP mode and confirmed via tools/list that all 24 tools register and the regenerated output schemas show the new shapes

[codacy-production]

Up to standards ✅

🟢 Issues 1 minor

Results:
1 new issue

Category	Results
Documentation	1 minor

View in Codacy

🟢 Metrics 15 complexity

Metric	Results
Complexity	15

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 21 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
anyio	4.14.1	Null	Unknown License
cffi	2.1.0	Null	Unknown License
click	8.4.2	Null	Unknown License
cyclopts	4.21.0	Null	Unknown License
fastmcp-slim	3.4.4	Null	Unknown License
griffelib	2.1.0	Null	Unknown License
joserfc	1.7.3	Null	Unknown License
mcp	1.28.1	Null	Unknown License
opentelemetry-api	1.43.0	Null	Unknown License
pydantic-settings	2.14.2	Null	Unknown License
pydocket	0.23.0	Null	Unknown License
pytest	9.1.1	Null	Unknown License
redis	8.0.1	Null	Unknown License
rich-rst	2.1.0	Null	Unknown License
rpds-py	2026.6.3	Null	Unknown License
ruff	0.15.21	Null	Unknown License
sse-starlette	3.4.5	Null	Unknown License
typer	0.26.8	Null	Unknown License
typing-extensions	4.16.0	Null	Unknown License
uv	0.11.28	Null	Unknown License
uvicorn	0.51.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/anyio	4.14.1	Unknown	Unknown
pip/cffi	2.1.0	Unknown	Unknown
pip/click	8.4.2	Unknown	Unknown
pip/cyclopts	4.21.0	Unknown	Unknown
pip/fastmcp-slim	3.4.4	Unknown	Unknown
pip/griffelib	2.1.0	Unknown	Unknown
pip/joserfc	1.7.3	Unknown	Unknown
pip/mcp	1.28.1	Unknown	Unknown
pip/opentelemetry-api	1.43.0	Unknown	Unknown
pip/pydantic-settings	2.14.2	Unknown	Unknown
pip/pydocket	0.23.0	Unknown	Unknown
pip/pyright	1.1.411	🟢 3.8	Details Check Score Reason Maintained 🟢 3 3 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 3 Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected
pip/pytest	9.1.1	Unknown	Unknown
pip/redis	8.0.1	Unknown	Unknown
pip/rich-rst	2.1.0	Unknown	Unknown
pip/rpds-py	2026.6.3	Unknown	Unknown
pip/ruff	0.15.21	Unknown	Unknown
pip/sse-starlette	3.4.5	Unknown	Unknown
pip/typer	0.26.8	Unknown	Unknown
pip/typing-extensions	4.16.0	Unknown	Unknown
pip/uv	0.11.28	Unknown	Unknown
pip/uvicorn	0.51.0	Unknown	Unknown

Scanned Files

• uv.lock